Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

51% of what was assessed

10 requirements were assessed of 15. The percentage is over those and nothing else.

OWASP · version 2.0

2 satisfied
6 partly covered
2 not satisfied
3 beyond your profile
2 not measured here

Governance

3 of 3

Requirement	Status	Controls
SM Strategy and Metrics	not measured here	nothing maps
PC Policy and Compliance	beyond your profile	6 controls, none counted
EG Education and Guidance	beyond your profile	3 controls, none counted

Design

3 of 3

Requirement	Status	Controls
TA Threat Assessment	50%	2 of 3 controls counted
SR Security Requirements	0%	1 of 2 controls counted
SA Security Architecture	beyond your profile	3 controls, none counted

Implementation

3 of 3

Requirement	Status	Controls
SB Secure Build	75%	2 of 8 controls counted
SD Secure Deployment	33%	3 of 13 controls counted
DM Defect Management	100%	2 of 6 controls counted

Verification

3 of 3

Requirement	Status	Controls
AA Architecture Assessment	100%	1 of 3 controls counted
RT Requirements-driven Testing	0%	1 of 4 controls counted
ST Security Testing	53%	5 of 11 controls counted

Operations

3 of 3

Requirement	Status	Controls
IM Incident Management	56%	3 of 9 controls counted
EM Environment Management	43%	7 of 16 controls counted
OM Operational Management	not measured here	nothing maps

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

EM Environment Management

in Operations

Harden the configuration of the environments the software runs in and keep every component of them patched and up to date on a defined cadence. Streams: Configuration Hardening; Patching and Updating.

Partly covered — 43%. The controls beneath it are covered in some of the places your profile required them and not in others.

No single control answers this requirement outright, so the 7 partial mappings your profile required are averaged.

Closing the 42 scopes listed here would move your overall coverage by 17.4 percentage points — exactly, over the same denominator the headline uses.

Counted toward this requirement

These produced the number above.

Cloud Posture Continuous Assessment1 of 3 scopes
Partial mapping · high confidence
What it is
Deployed cloud resources are assessed continuously against configuration policy and deviations raise an alert.
Why it matters
Cloud resources are created by many hands and by pipelines, and one exposed storage account or over-permissive role is enough.
Why it maps EM-A configuration hardening, verified continuously rather than at a review date.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
Development Azure Operate Continuous Scan
Test Azure Operate Continuous Scan
In place looks like Every account or subscription is assessed continuously against configuration policy, and a new deviation alerts a named owner rather than waiting for a monthly report.
Cloud Guardrail Enforcement3 of 3 scopes
Partial mapping · high confidence
What it is
Platform-level guardrails prevent a non-compliant cloud resource from being created at all, instead of reporting it afterwards.
Why it matters
Detecting a misconfigured resource after it exists leaves a window in which it is live and reachable.
Why it maps EM-A at higher maturity: the hardened configuration cannot simply be opted out of.
Covered everywhere your profile required it.
Cluster Benchmark Assessment0 of 3 scopes
Partial mapping · high confidence
What it is
The cluster configuration is assessed against a recognized hardening benchmark on a recurring schedule.
Why it matters
Cluster settings drift with upgrades and manual fixes, and the control plane is the part of the platform no application test exercises.
Why it maps EM-A expects hardening to be measured against a recognised baseline, which is a benchmark.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
Development Kubernetes Operate Continuous Scan
Test Kubernetes Operate Continuous Scan
Production Kubernetes Operate
Kubernetes Workload Configuration Scan0 of 6 scopes
Partial mapping · medium confidence
What it is
Workload definitions are checked for unsafe settings such as privileged containers, missing resource limits or over-broad service accounts.
Why it matters
A privileged container or an over-broad service account hands an attacker the rest of the cluster after a single application compromise.
Why it maps Extends hardening from the platform to the workloads running on it.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
Development Kubernetes Code Pull Request
Development Kubernetes Build CI Pipeline
Test Kubernetes Code
IaC Misconfiguration Detection6 of 12 scopes
Partial mapping · medium confidence
What it is
Infrastructure-as-code definitions are checked against security policy before the change is merged, and a critical misconfiguration blocks the merge.
Why it matters
A public bucket or an open security group written into infrastructure code is deployed everywhere that module is used, and is easiest to stop in the change that introduces it.
Why it maps Hardening enforced where the environment is defined; it constrains what will be built rather than assessing what is running.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
Development Helm Code Pull Request
Development Helm Build CI Pipeline
Test Helm
Known Vulnerability Scan5 of 30 scopes
Partial mapping · high confidence
What it is
Deployed assets are matched against published CVE data to find known vulnerabilities in what is actually running.
Why it matters
What is running is not always what was last built — older versions stay deployed, and the inventory in somebody's head is optimistic.
Why it maps EM-B patching starts from knowing which deployed components are behind.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
Development Java Deploy CD Pipeline
Development Java Operate Continuous Scan
Development Spring Boot Deploy
Container Image Vulnerability Scan6 of 6 scopes
Partial mapping · medium confidence
What it is
Container images are scanned for vulnerable operating-system and application packages before and after they enter the registry.
Why it matters
Most of a container image is an operating system nobody on the team chose, and it ages between the day it is built and the day it is replaced.
Why it maps The same patch question asked of the image layers a workload actually runs.
Covered everywhere your profile required it.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Continuous Re-Scan After Releasenot required
Partial mapping · high confidence
Why it maps EM-B expects patch status to be tracked over time; a component becomes vulnerable long after it shipped.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

IaC Build Scannot required
Supporting · medium confidence
Why it maps A second check on the same definitions before they are applied.
Admission Policy Audit Mode3 of 3 scopes
Supporting · medium confidence
Why it maps Reports workloads that violate the hardening standard without blocking them.
Container Image Policy Gatenot required
Supporting · medium confidence
Why it maps Keeps images that fall below the environment standard out of it.
Network Segmentation Policy6 of 12 scopes
Supporting · medium confidence
Why it maps Network reachability is part of the environment configuration EM-A hardens.
Egress Traffic Control

SM Strategy and Metrics

not measured here

nothing maps

PC Policy and Compliance

beyond your profile

6 controls, none counted

EG Education and Guidance

beyond your profile

3 controls, none counted

TA Threat Assessment

50%

2 of 3 controls counted

SR Security Requirements

1 of 2 controls counted

SA Security Architecture

beyond your profile

3 controls, none counted

SB Secure Build

75%

2 of 8 controls counted

SD Secure Deployment

33%

3 of 13 controls counted

DM Defect Management

100%

2 of 6 controls counted

AA Architecture Assessment

100%

1 of 3 controls counted

RT Requirements-driven Testing

1 of 4 controls counted

ST Security Testing

53%

5 of 11 controls counted

IM Incident Management

56%

3 of 9 controls counted

EM Environment Management

43%

7 of 16 controls counted

OM Operational Management

not measured here

nothing maps

Environment

Technology

Phase

Control point

Development

Azure

Operate

Continuous Scan

Test

Azure

Operate

Continuous Scan

Environment

Technology

Phase

Control point

Development

Kubernetes

Operate

Continuous Scan

Test

Kubernetes

Operate

Continuous Scan

Production

Kubernetes

Operate

Environment

Technology

Phase

Control point

Development

Kubernetes

Code

Pull Request

Development

Kubernetes

Build

CI Pipeline

Test

Kubernetes

Code

Environment

Technology

Phase

Control point

Development

Helm

Code

Pull Request

Development

Helm

Build

CI Pipeline

Test

Helm

Environment

Technology

Phase

Control point

Development

Java

Deploy

CD Pipeline

Development

Java

Operate

Continuous Scan

Development

Spring Boot

Deploy